| Summary: | HTML escaped via JavaScript should encode all entities | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Kyle M Hall (khall) <kyle> |
| Component: | Architecture, internals, and plumbing | Assignee: | Bugs List <koha-bugs> |
| Status: | NEW --- | QA Contact: | Testopia <testopia> |
| Severity: | enhancement | ||
| Priority: | P5 - low | CC: | dcook, kyle, phil |
| Version: | Main | ||
| Hardware: | All | ||
| OS: | All | ||
| Change sponsored?: | --- | Patch complexity: | --- |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: | Version(s) released in: | ||
| Circulation function: | |||
| Bug Depends on: | 36382 | ||
| Bug Blocks: | |||
|
Description
Kyle M Hall (khall)
2024-03-21 13:47:33 UTC
(In reply to Kyle M Hall from comment #0) > In staff-global.js, we have a function escape_str. This function only > encodes a tiny subset of html characters. We should use > https://github.com/mathiasbynens/he to encode the full set of html entities. In theory, escape_str might work as a "HtmlAttributeEncode" method if it were to include double quotes, single quotes, ampersands, and angle brackets. But I think we're trying to use it in context where a full HTML entity encode is needed. Overall, I think we should be writing better Javascript, but adding layers of protection is useful I think. |